Windows DHCP Client: Heap-based buffer overflow allows privilege escalation

Summary

A heap-based buffer overflow in the Windows DHCP Client service allows an authorised attacker to elevate privileges. The attacker must already be on the same network segment (adjacent network) and hold a low-privileged local account. Successful exploitation could affect confidentiality, integrity and availability, with a CVSS base score of 8.0.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 and Server Core installation (10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 and Server Core installation (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)

Fixed in

• Fixed builds per the CVE record ranges above; the record lists the first unaffected build per version.
• Windows 10 1607 and Server 2016: 10.0.14393.9688 (reported by a secondary source, not yet verified against MSRC)
• Windows 10 1809 and Server 2019: 10.0.17763.9487 (reported by a secondary source, not yet verified against MSRC)
• Windows 10 21H2: 10.0.19044.7846 (reported by a secondary source, not yet verified against MSRC)
• Windows 10 22H2: 10.0.19045.7846 (reported by a secondary source, not yet verified against MSRC)
• Windows 11 23H2: 10.0.22631.7711 (reported by a secondary source, not yet verified against MSRC)
• Windows Server 2022: 10.0.20348.5870 (reported by a secondary source, not yet verified against MSRC)
• Windows 11 24H2 and 25H2: Unknown. Check the MSRC advisory.
• Fix is part of the Microsoft November 2026 security update (vendor confirmation pending).

Workaround

Unknown. No workaround is documented in the sources reviewed. Installing the security update is the remedy.

Exploitation

• Unknown. No public proof of concept or report of in-the-wild exploitation was found in the sources reviewed.
• Microsoft's exploitation flag could not be verified.

Our recommendation

• Install the November 2026 cumulative update on all affected Windows 10, 11 and Server systems, starting with servers and shared workstations.
• Confirm the fixed build for Windows 11 24H2 and 25H2 on the MSRC advisory before the next inventory check.
• Limit access to the office LAN and guest networks, and use 802.1X or port security where possible.
• Review DHCP Server issues published in the same release (for example CVE-2026-88243) with higher priority if your servers run the DHCP role.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-88240 (CVE.org) www.cve.org
• Microsoft Security Update Guide CVE-2026-88240 msrc.microsoft.com
• Strix CVE-2026-88240 (secondary, fixed builds) www.strix.ai
• Strix CVE-2026-88243 (DHCP Server, related) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:48.